BTCPay Server 2.4.5 tightens security and speeds up invoices
Crypto Briefing 2026-10-06 17:35:16
Context: BTCPay Server has released version 2.4.5, focusing on enhanced security and faster invoice processing. The update, led by developers Nicolas Dorier and Pavlenex, and announced on October 5, 2026, introduces protections against Server-Side Request Forgery (SSRF) and tightens refund permissions. This release follows previous security-focused updates in August and September 2026.
Key Facts
- BTCPay Server version 2.4.5 adds protections against Server-Side Request Forgery (SSRF) across Lightning and LNURL outbound requests, plus invoice webhooks.
- The update tightens permissions required to approve refunds, reducing insider risk and potential damage from compromised accounts.
- Public invoice details will now be hidden one month after an invoice is issued, enhancing privacy by preventing old payment pages from broadcasting information indefinitely.
- Tor support in the Docker deployment is now optional, requiring existing users to manually re-enable Tor after updating to maintain service reachability.